72902-46637773@requests.muckrock.com (Anonymous requestor) 
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Please use email only. I am an anonymous user of MuckRock.com, not a MuckRock representative. 


SUNSHINE ORDINANCE TASK FORCE 
Room 244 

1 Dr. Carlton B. Goodlett Place 
San Francisco CA 94102 
sotf@sfgov.org 
sent via email 


Your ref. 

#19047 

RE: SF Sunshine Ordinance Complaint against Office of Mayor, ref 19047 

To the Sunshine Ordinance Task Force: 

NOTE: Every response you send or provide (including all responsive records) may be 
automatically and immediately visible to the general public on the MuckRock.com 
web service used to issue this request. (I am not a representative of MuckRock) 

On May 11, 2019, I filed a Sunshine Ordinance complaint with your Task Force against the Office 
of the Mayor, Mayor London Breed, Hank Heckel, and sent a copy to the Mayor’s office by email 
as a courtesy. 

On May 14, 2019, Cheryl Leger, Assistant Clerk, Board of Supervisors captioned my complaint 
190 f 7, Anonymous v. Mayor London Breed and Hank Heckel, Office of the Mayor and requested 
from the Office of the Mayor a response within 5 business days. 

On May 21, 2019, Mr. Heckel on behalf of the Mayor filed their response. A rebuttal to the Mayor’s 
response follows below. 

1. Prop. G does not limit the portions of calendars that are disclosable public 
records 

a) Respondents argue that all (1999) Prop. G (SF Admin Code Sec. 67.29-5) information 
was disclosed (Response pg. 2) and in the “Prop G format” (Response pg. 1). However, 
SF Admin Code Sec. 67.29-5 merely sets the minimum requirements for what calendar 
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information must be kept by the Mayor (and other specified officials). It in no way 
excludes other information from being disclosed, and does not alter the definition of 
“public records” under the Sunshine Ordinance or CPRA in anyway. If the Mayor’s office 
in fact prepares, owns, uses, or retains any additional calendar or scheduling information 
(in paper or electronic format) re: the Mayor’s calendar beyond the requirements of 
SF Admin Code Sec. 67.29-5, “relating to the conduct of the public’s business,” those 
records or portion thereof would also be public records, and must be disclosed unless 
specifically exempt under the CPRA/Sunshine Ordinance. 

b) Respondents argue “The Prop G calendar maintained by the Office of the Mayor does not 
use the invite feature of the Outlook calendar to invite and record attendees” (Response 
pg. 2, emphasis mine). The disclosed record itself is labeled “PropG, Mayor (MYR).” 

It is unclear whether there is some other (non-Prop G) calendar maintained by the 
Mayor’s office. Our request was for, inter alia, “an electronic copy, in the original elec¬ 
tronic format, with all calendar item headers, email addresses, metadata, timestamps, 
attachments, appendices, exhibits, and inline images, except those explicitly exempted 
by the Ordinance, of the Mayor’s calendar, ...” Therefore either the Mayor’s office should 
declare that it has no other records responsive to our request (i.e. the Mayor keeps no 
more detailed calendar information other than Prop. G information, which is difficult 
to believe) or state that all other such records are exempt from disclosure, with specific 
justification. The fact that information is not part of Prop. G/SF Admin Code Sec. 

67.29- 5 is not a justification for exemption. Furthermore, Prop. G (SF Admin Code Sec. 

67.29- 5) does not specify any format for calendar information. Neither SF Admin Code 
Sec. 67.29-5 nor any other provision of the Sunshine Ordinance can be interpreted in a 
way that would reduce my rights under the state-wide CPRA or conflict with it. To the 
extent that Respondents argue that only Sec. 67.29-5 calendar information is public, 
such argument would violate the CPRA. 

c) Respondents argue no “substantiative information” has been withheld (Response pg. 1, 

2). The CPRA and Sunshine Ordinance do not permit public agencies to determine for 
themselves what information is “substantiative.” These laws concern themselves with the 
records only, and let the public decide for itself what records are important. However, I 
also argue why the information I seek is important below. 

2. Metadata is not categorically exempt from disclosure 

a) As background, while not binding upon your Task Force, consider this note from League 
of California Cities’ “The People’s Business” 1 : 

Agencies that receive requests for metadata or requests for records that include 
metadata should treat the requests the same way they treat all other requests 
for electronic information and disclose nonexempt metadata. 

It also points out that “evolving law in other jurisdictions has held that local agency 

1 Retrieved June 3, 2019. April 2017. League of California Cities. “The People's Business." Page 14. 

http://www. cacities . org/Resources/Open-Government/THE-PEOPLE7.E27o807o99S-BUSINESS-A-Guide-to-the-Calif ornia-Pu. 
aspx 
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metadata is a public record subject to disclosure unless an exemption applies” 2 (see 
Lake v. City of Phoenix, (2009) 218 P.3d 1004, 1008; O’Neill v. City of Shoreline (2010) 
240 P.3d 1149, 1154; Irwin v. Onondaga County (2010) 895 N.Y.S.2d 262, 268.). 

b) Respondents argue that they do not index metadata as records, do not generally search 
metadata, and (this Administration) have not provided them in the past (Response 
pg. 3). The Mayor’s failure to index and in the past search for or provide metadata 
has no bearing on whether they are, under the Sunshine Ordinance or CPRA, in fact, 
public records. Furthermore, the Office of the Mayor (under Mayor Lee) did provide, 
for example, certain metadata (i.e. From, To, Sent, and Subject headers) in response to 
e-mail records request 3 . Calendars and emails are not identical, and I do not concede 
that those few headers constitute sufficient disclosure (and in fact argue as much under 
a separate parallel SOTF complaint 190ff, Anonymous v. Dennis Herrera, Elizabeth 
Coolbrith ), but it is the case that some metadata has in fact been disclosed by the Office 
of the Mayor in the past. 

c) Respondents argue that metadata could create security risks or disclose privileged infor¬ 
mation (Response pg. 3). Respondents cite certain articles regarding hacking of the City 
of Atlanta systems (Response Attachment pp. 12-19), however the article itself does not 
seem to argue that such breaches were caused by disclosure of metadata. It is however 
the case that certain headers and similar could in fact create security risks, but this is 
not a blanket reason to withhold all headers or metadata. 

d) There are ways for the Mayor (and other City agencies) to both meet their requirements 
under the Sunshine Ordinance, CPRA, and California Constitution while protecting the 
City’s security. One proposal I made in 190ff, Anonymous v. Dennis Herrera, Elizabeth 
Coolbrith was 4 : 

the City Attorney publishes an opinion that in its independent legal judgment, 
and in good faith consultation with information technology security experts, that 
all e-mail header names are non-exempt and at least the following e-mail header 
values (in addition to body, attachments and inline images) [Date, Sender, 
Message-Id, To, From, Subject, Mime-Version, Content-Type, Return-Path, Cc, 

Bcc, X-Envelope-From, Thread-Topic, Thread-Index, Sender, References, In- 
Reply-To, X-Originatororg, Delivered-To, X-Forwarded-To, X-Forwarded-For] 
are in fact not automatically exempt from disclosure (unless the specifc [sic] 
content is exempt); 

A similar process can be used for calendar items and electronic records in general: that 
the City consult with IT security experts and provide uniform policies on which head¬ 
ers/metadata are genuinely exempt due to security concerns and directing that others 
can be safely released. 


2 lbid. 

3 See for example https://www.muckrock.com/foi/san-francisco-141/ed-lee-emails-52899/ 

4 My May 17, 2019 follow-up to SOTF 19044, pg. 3, https://cdn.muckrock.com/outbound_request_attachments/ 
Anonymous_2859385/72056/SF-Email- Appeal-72056- SOTF - 19044- corrected- a. pdf 
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e) Respondents argue it is “necessary to withhold metadata that describes unique identifiers 
for individual computer terminals and computer servers and associated security certifi¬ 
cates and similar information.” (Response pg. 3) To the extent that means IP addresses 
and certificate private keys are exempt under the Sunshine Ordinance, I do not disagree. 
I am not sure how certificate private keys could be stored in calendar items. 

f) To the extent that metadata could include attorney-client privilege, work product priv¬ 
ilege, identity of a confidential whistleblower or protected health information (Response 
pg. 3), that concern exists for the non-metadata “body” of any record as well. It is 
routinely redacted and handled correctly by City agencies, and it should be no different 
for metadata. In SOTF 19044> Anonymous v. Dennis Herrera, Elizabeth Coolbrith for 
example, the City Attorney disclosed a redacted version of an email I requested by print¬ 
ing the entire record with all headers and then redacting the ones they felt were exempt 
from disclosure 5 . I argued 6 7 in 19044 that this disclosure remains insufficient due to the 
specifics of the headers not disclosed, but it shows that a process is possible. 

3. Respondents should disclose calendars in their native formats 

a) Respondents argue the iCalendar format would be a native file of the whole calendar 
(Response pg. 4). I agree, and that would be a record responsive to my request. Meta¬ 
data would in fact have need to be redacted appropriately (see 2f above). Respondents 
argue the .ics format is not typically used or maintained by them (Response pg. 4). 
However, the ‘.ics’ format is another name for the iCalendar format.' I used both names 
in my request since they may not be familiar terms. 

b) Respondents argue that they do not hold “the Prop G calendar in an iCalendar, .ics or 
Vcard format” (emphasis mine, Response pg. 3). First, as argued in my Part 1, I have 
never requested only the Prop G calendar - all calendar information for the Mayor, in any 
format, for the days requested are responsive public records. Second, while Respondents 
may neither “hold” nor make copies for themselves or other agencies in iCalendar or vCard 
formats, it is difficult to believe that the only format Respondents hold calendar records 
is in PDF - this would be impractical to edit and use on a day-to-day basis. My request 
was for “an electronic copy, in the original electronic format” of the calendar. From 
the appearance of the disclosed partial calendar record, it appears the Respondents use 
Microsoft Outlook and/or Exchange for their Calendars. Microsoft Outlook/Exchange 
certainly do not “hold” calendar data in PDF formats. I did suggest .ics, iCalendar, or 
vCard as potential formats, as they are well-known or standardized formats. If anything, 
the concern about security risks should be lower using, for example, iCalendar, since it 
is publicly defined as a standard in IETF RFC 5545 (https: //tools. ietf . org/html/ 
rfc5545 - as subsequently amended by RFCs 5546, 6868, 7529, 7953, 7986). Using the 
native formats does not preclude Respondents from redacting that specific information 
which is exempt under the Sunshine Ordinance. 

5 See https://cdn.muckrock.com/foia_files/2019/05/17/4-18-19_Email_Received_Redacted.pdf 

6 My May 17, 2019 follow-up to SOTF 19044, pp. 2—3, https://cdn.muckrock.com/outbound_request_attachments/ 
Anonymous_2859385/72056/SF-Email- Appeal-72056- SOTF - 19044- corrected- a. pdf 

7 https://en.Wikipedia.org/wiki/ICalendar 
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4. Respondents failed to justify their withholding adequately. On May 9, 2019, Respon¬ 
dents cited Cal. Gov. Code 6253.9(a)(1) and Cal. Gov. Code 6253.9(f) as reasons to provide 
PDF formats as opposed to the original electronic format. They addressed solely the format 
issue. They provided us no determination whether the metadata/headers I requested existed 
and did not state they were withholding it (SF Admin Code 67.21(b), Govt Code 6253(c)), 
and they did not justify doing so (SF Admin Code 67.27). Furthermore, SF Admin Code 
67.26 states in relevant part: 

Information that is exempt from disclosure shall be masked, deleted or otherwise 
segregated in order that the nonexempt portion of a requested record may be re¬ 
leased, and keyed by footnote or other clear reference to the appropriate justification 
for withholding required by Section 67.27 of this Article. 

If Respondents wished to withhold metadata/headers they should have printed it out in PDF 
format (since they prefer PDF), redacted the specific portions, and justified each redaction. 
If any non-“Prop G” calendar records do in fact exist (something I do not believe has been 
determined), Respondents did not address their existence or withholding in their response, 
either. 

5. Metadata and native formats include information that is both non-exempt and 
important. San Francisco does not permit its agencies to use the public interest balance 
exemption (SF Admin Code 67.24(g,i)), however, I thought it would be useful to explain 
why non-exempt metadata and native formats may be useful to the public. Native formats 
allow the public to easily search, index, import, and analyze information about the public 
business; PDFs create an additional barrier to making this information universally accessible 
as they are not optimized for calendar storage. Metadata that does not put the City at 
risk for security breaches and is not otherwise exempt include information such as which 
event attendees accepted/rejected an invite, when an invite was created, when it was sent or 
received, who actually sent it (the Mayor, vs. her subordinates), which party initiated the 
calendar invite and more. Metadata can help answer common investigative and journalistic 
questions including “who knew what, and when did they know it?” 

I respectfully ask that your Task Force find the Respondents did violate the Sunshine Ordinance 
through their May 9, 2019 response to my records request, that Respondents continue to do so, and 
direct the Respondents to: 

1. Disclose all other calendar records (in whatever form, whether Prop G or not Prop G) in the 
date range requested. 

2. Disclose all metadata/header names and all values except those values specifically exempt 
(regardless of the format used). 

3. Produce the calendar records (including both the Prop G records previously disclosed in PDF 
form, and any new calendar items they disclose) in their native electronic format (or another 
format like iCalendar if it preserves those metadata). 
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Item 1 should be performed even if your Task Force finds all metadata categorically exempt and 
does not find that the Respondents are required to produce records in their original electronic 
format. Per our original request: “Please provide only those copies of records available without any 
fees. If you determine certain records would require fees, please instead provide the required notice 
of which of those records are available and non-exempt for inspection in-person if we so choose.” 

I hope that the complaint is now ripe for consideration by your Task Force or a committee thereof. 
As it would be difficult for me to be physically present at any in-person hearings, and in order 
to maintain my anonymity, I would appreciate the opportunity to be heard via conference call 
(telephone, Google Hangouts, Skype, etc.) if needed. Since this e-mail mailbox is completely public, 
I can send an email from a private address to retrieve conference call connection information if it 
is available. 

Sincerely, 

72902-46637773@requests.muckrock.com (Anonymous requestor) 
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